An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade protobuf | Apr 19, 2023 | Jan 10, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Dell Powerstore Dsa2024287 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jul 2, 2024 |
| Oracle Missing Cpu Apr 2022 | — | Apply the April 2022 Critical Patch Update (CPU) for Oracle Database | Apr 20, 2022 | Jan 7, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35227385 for version 14.1.1.0.0. | Jul 19, 2023 | Jan 7, 2022 |
| Suse | — | Upgrade python2-protobufUpgrade protobuf-develUpgrade python3-protobufUpgrade libprotoc20-32bitUpgrade protobuf-javaUpgrade libprotobuf20-32bitUpgrade libprotobuf-lite20Upgrade libprotobuf-lite20-32bitUpgrade libprotoc20Upgrade libprotobuf20Upgrade protobuf-source | Nov 10, 2022 | Jan 10, 2022 |
| Ubuntu | — | Upgrade libprotobuf23Upgrade libprotobuf-javaUpgrade libprotoc23Upgrade protobuf-compilerUpgrade python3-protobufUpgrade libprotobuf-lite23 | Mar 22, 2023 | Jan 10, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub